Check: CISC-RT-000700
Cisco NX OS Switch RTR STIG:
CISC-RT-000700
(in versions v2 r3 through v1 r0.1)
Title
The Cisco PE switch providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces. (Cat II impact)
Discussion
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.
Check Content
Review the switch configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS as shown in the example below: interface Ethernet2/4 no shutdown no switchport storm-control broadcast level 40.00 service instance 1 ethernet encapsulation dot1q 100 If storm control is not enabled at a minimum for broadcast traffic, this is a finding.
Fix Text
Configure storm control for each CE-facing interface as shown in the example below: SW1(config)# int e2/4 SW1(config-if)# storm-control broadcast level 40 SW1(config-if)# end
Additional Identifiers
Rule ID: SV-221123r622190_rule
Vulnerability ID: V-221123
Group Title: SRG-NET-000193-RTR-000002
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001095 |
The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks. |
Controls
Number | Title |
---|---|
SC-5 (2) |
Excess Capacity / Bandwidth / Redundancy |